Privacy & Cookie Policy

Last updated: 25 October 2026

This notice explains how Prism Integrated Security Solutions Ltd (“Prism”, “we”, “us”) collects, uses, stores and shares personal data, and the rights available to you. It is provided under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our use of cookies is additionally governed by the Privacy and Electronic Communications Regulations 2003 (PECR).

It applies to:

• visitors to this website, including anyone using our online system builders or booking a survey
• people who contact us by telephone, email or through our enquiry forms
• customers who engage us to install, maintain or monitor security or MediCare systems, and users of our customer portal
• keyholders and contacts registered on alarm monitoring accounts

1. Who we are

The data controller — the organisation responsible for deciding how your personal data is used — is Prism Integrated Security Solutions Ltd, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ.

We are registered with the Information Commissioner’s Office (ICO) under reference ZC183779. You can verify registered data controllers on the ICO register.

For anything in this notice, or to exercise any of your rights, contact our data protection contact at dpo@prismintegratedsecurity.solutions, call 0330 236 8191, or write to the registered office above. You can also use the form on our contact page.

2. The personal data we collect

We collect only the data needed for a specific, stated purpose. What we hold depends on your relationship with us.

Enquiries and contact forms

• Identity and contact data — your name, email address and phone number
• Company name and postcode, where you provide them
• The content of your message, and your marketing preference (an unticked opt-in box) — if you tick it, a record of your consent: the address, your name, and when you gave it

Online system builders

If you design a system with our alarm or MediCare builder, we collect your contact details, the installation address, and the property details you enter — floors, rooms, doors and windows — because they are the design. For business customers we also look up and store your company’s registered name, number and registered office from the Companies House public register, so your quotation names the right legal entity.

Health information (special category data)

The MediCare builder includes a free-text notes field where you may choose to tell us about health considerations — for example, that the person the system is for is at risk of falls. This is special category data under Article 9 UK GDPR. We process it only with your explicit consent, which you give by choosing to write it, and we use it solely to design and deliver a suitable system. Share only what you are comfortable sharing — the builder works without it — and you can ask us to delete these notes at any time by contacting dpo@prismintegratedsecurity.solutions.

Survey bookings

When you book a survey we collect your name, contact details, the site address and your chosen appointment slot. If you give us a mobile number we text you a confirmation of the booking, and again if we have to move it. These are service messages, not marketing.

Customers

• Contract and service data — quotations, contracts, invoices, installed systems and equipment, certificates, maintenance history and engineer visit notes
• Site data — installation addresses and, for monitored systems, access details, zone descriptions and response procedures
• Keyholder data — names, phone numbers and call priorities for the keyholders you nominate on a monitoring account
• Order data — the parts you order from us, where they are delivered and who receives them, the carrier and the tracking number
• Payment data — card and Direct Debit payments, including the monthly Direct Debits of an instalment plan or a service plan, are taken by Stripe on its own payment pages, so the card or bank details you enter there go to Stripe and not to us. Our own records keep only Stripe's reference numbers for you, your payments and your Direct Debit mandate, and what happened to each payment. If you pay an invoice by bank transfer instead, we see the payer name and reference on the incoming payment. If money goes back to you outside Stripe — we pay it back by bank transfer, or your bank returns a payment — we record how much, the day, and a note of what we saw, such as the transfer's reference.

If you nominate keyholders, you must make sure those people know their details will be shared with our monitoring partner for alarm response. Point them to this notice.

Customer portal accounts

Portal accounts hold your sign-in email address, your sign-in history, and the documents we have issued to you — quotations, invoices and certificates.

Signing your contract electronically

When you sign a Job Specification from the link we email you, we record your name, the capacity you sign in (for example home owner or director), your drawn signature, the date and time, and the technical details of the signing session — the IP address the request came from, your browser’s identifying string, and a one-off signing reference generated in your browser. These form part of the contract record: they are the evidence that the signature was given, our lawful basis for them is the contract itself, and we keep them for as long as we keep the signed contract.

Technical data

Our hosting infrastructure records standard server logs (IP address, browser type, pages requested) which we use for security and fault diagnosis. The portal sign-in and our enquiry, builder and survey-booking forms carry a security check, Cloudflare Turnstile, which reads technical details of your browser and device to tell a person from an automated script. Our website analytics are aggregate and cookie-free — see the cookies section below.

3. Why we use it, and our lawful bases

Under Article 6 UK GDPR we must have a lawful basis for every use of personal data. These are ours:

Where we rely on legitimate interests we have balanced our interests against your rights and freedoms. You can object to any processing based on legitimate interests — see your rights below.

You can stop marketing at any time, and it stops at once. Every marketing email we send carries an unsubscribe link at its foot: it opens a page where one press of Unsubscribe records that you want no more, with no sign-in. Where your email program shows its own Unsubscribe button for one of our emails, pressing that does the same. Or tell us — email dpo@prismintegratedsecurity.solutions, call 0330 236 8191, or reply to any email from us — and we will record it for you. We keep that record for good, so your request is always honoured (see section 6). Opting out never affects service messages about work you have asked us to do.

4. Who we share it with

We do not sell, rent or trade personal data — to anyone, ever. We share it only where necessary, and each heading below says on what terms.

Alarm monitoring — EMCS

Monitored systems are connected to EMCS (East Midlands Central Station Limited), the UK’s largest independent Alarm Receiving Centre, NSI Gold certified. EMCS processes keyholder and alarm event data as our data processor, under a written data processing agreement, only on our instruction and only to provide monitoring and response.

Service providers

These handle personal data for us, on our instructions, under written contracts that meet Article 28 UK GDPR.

• Supabase — our database, customer sign-in and document storage, hosted on AWS in London (UK)
• Vercel — hosting for this website and the customer portal (the servers that run them are in London), and our cookie-free, aggregate visitor analytics on the public pages of this website, not inside the portal
• Resend — delivery of the emails we send you, and word back when one could not be delivered
• Twilio — delivery of the text messages we send you about your bookings, installations, visits, quotations, orders and complaints
• Stripe — card and Direct Debit payments, taken on Stripe's own payment pages. Stripe receives your name and email address, the amount and what it is for (a quotation or invoice reference), our reference numbers for you and the payment, and the details you enter on its pages, such as your card or bank details and billing address. For some purposes of its own, such as preventing fraud and meeting the legal duties of a payment provider, Stripe is a controller in its own right and uses that information under its own privacy policy
• Cloudflare — Turnstile, the security check on the portal sign-in and on our enquiry, builder and survey-booking forms, which receives your IP address and technical details of your browser and device

Address look-ups and the map

The contracts above do not cover these.

• postcodes.io, getAddress.io and what3words — address and location look-ups. Our server sends them only a postcode, or the map position of one, never your name or contact details
• Google — the map on our contact page. It loads only if you choose to show it; your browser then loads it straight from Google Maps, not through us, so Google receives your IP address under Google's privacy policy and may set its own cookies (see section 10)

Delivering the parts you order

When we post parts to you, we give the carrier that takes the parcel — Royal Mail, Parcelforce, DPD, UPS or DHL — the name and delivery address on the order, and a phone number or email address only where that carrier needs one to arrange the delivery. When a supplier sends your parts straight to you, we give that supplier the name, delivery address and contact phone number on the order with the list of parts it is sending, and it hands the parcel to its carrier. Neither is sent what you paid or anything else about your security system. Each uses the details to deliver the parcel and to tell you about it, under its own privacy policy.

Others

• Vetted subcontracted engineers, who receive only the minimum needed for a specific job — typically the site address and access arrangements — under written confidentiality agreements
• Professional advisers — accountants, solicitors and insurers — where necessary, bound by professional confidentiality
• Police, courts, regulators and other public authorities, where the law requires it; we will tell you unless we are legally prevented from doing so

5. International transfers

Your data is stored in the United Kingdom — our database, documents and sign-in records live in a London data centre, and the servers that run the customer portal are in London too. Some of our service providers are US companies, or run networks around the world, so some data may be processed outside the UK: for example, the technical details of a visit to this website or of the security check on our forms, an email address on an outgoing email, a phone number on a text message, or the name, email address and payment details Stripe handles when you pay. Where that happens we rely on the UK Extension to the EU–US Data Privacy Framework (the UK–US Data Bridge) or the ICO’s International Data Transfer Agreement, as Chapter V UK GDPR requires.

6. How long we keep it

When a retention period ends, data is securely deleted or anonymised. We may keep data longer where a court order, live legal proceedings or a specific regulatory obligation requires it, and will tell you where that applies.

When the three-year period for enquiry, builder and survey-booking data ends, we delete those records — your enquiry and our replies, what you told our online builders, your survey booking, and our notes of following them up — along with any quotation we prepared for you but never sent. A quotation we did send keeps its figures and description, and our own notes from reviewing it before it went, as the record of the offer we made, but no longer says who it went to or what you wrote back. If we opened a customer record to survey your property, it no longer carries your name, contact details or the property’s address beyond its town and the first half of its postcode, and the assessments from that survey are deleted, signed copies included — unless you hold a portal account with us, or we hold a record of a security system of yours. If you ticked the box to hear from us, we keep the record of that consent — the address, your name, and when you gave it — until three years after you withdraw it. If you ask us to stop marketing to you — by the unsubscribe link or by telling us — we keep your email address, and when and how you asked, for good, so that we never market to you again; if you told us rather than using the link, our note of how your request reached us is removed three years after it.

Our systems keep an audit log of changes to the records described in this notice: what changed, when, and which member of our staff changed it, so that we can show how a record came to say what it says. Audit-log entries are kept for 7 years and then deleted. When enquiry, builder and survey-booking records reach the end of their three-year period, the audit-log entries about them are emptied at the same time, keeping only the fact that a record existed and changed, when, and by whom. The health notes you may give us in the MediCare builder are never copied into the audit log.

7. How we protect it

• Encryption in transit for every connection to the website and portal
• Row-level access controls in the database — a portal account can read its own records and nothing else
• Least-privilege staff access, with an audit log recording who changed what: no staff account can alter it, and its entries are emptied or deleted only under the retention periods in section 6
• Documents stored in a private bucket, never on public URLs

8. Automated processing

Our online builders generate a system specification and draft quotation automatically from your answers. A person reviews every quotation before it is sent, and no decision producing legal or similarly significant effects is made about you by automated means alone.

9. Your rights

Under UK GDPR you have the right to:

• Access (Article 15) — request a copy of the personal data we hold about you (a Subject Access Request)
• Rectification (Article 16) — have inaccurate or incomplete data corrected
• Erasure (Article 17) — have data deleted where there is no compelling reason to keep it
• Restriction (Article 18) — limit how we use your data, for example while you contest its accuracy
• Portability (Article 20) — receive data you gave us in a structured, machine-readable format, where processing is based on consent or contract
• Objection (Article 21) — object to processing based on legitimate interests, and to direct marketing, which we must stop immediately
• Freedom from solely automated decisions (Article 22) — as described above, we do not make any
• Withdraw consent at any time, where processing relies on it — including health notes and marketing. Withdrawal does not affect processing already carried out.

To exercise any right, email dpo@prismintegratedsecurity.solutions or use the contact page. We respond within one calendar month and there is no fee, though we may need to verify your identity first. Some rights are subject to legal exemptions — where one applies, we will explain it.

You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would welcome the chance to resolve your concern first.

10. Cookies

The cookies we set are strictly necessary cookies only — the session cookies that keep you signed in to the customer portal. Under PECR, strictly necessary cookies need no consent.

We do not set analytics, advertising or social media cookies. Specifically:

• our visitor analytics (Vercel Web Analytics) are cookie-free and aggregate — no identifier is stored on your device and no profile of you is built
• there are no Google Analytics, Meta, LinkedIn or TikTok tags on this site

The map on our contact page is loaded from Google Maps, and only if you press “Show the map” — nothing is fetched from Google before then. When it loads, Google receives your IP address and may set cookies of its own, under Google’s privacy policy. “Open in Google Maps” shows the same place in a new tab instead.

You can block or delete cookies in your browser settings at any time; blocking the portal session cookie simply means you cannot stay signed in. If we ever set cookies of our own that require consent, we will add a consent mechanism and update this policy before they are set.

11. CCTV installed at your property

Where we install a CCTV system at your property, you are the data controller for the footage it captures — not Prism — and you have your own obligations under UK GDPR: display clear signage, limit retention (we recommend 31 days by default), store footage securely, and respond within one month to access requests from people who appear in it. The ICO’s video surveillance guidance explains these duties.

During installation, commissioning and maintenance our engineers may view live or recorded footage solely for testing and diagnosis. We do not copy, retain or store footage from customer systems, and any remote access for fault diagnosis is logged and limited to the minimum necessary. Ajax systems we install use end-to-end encryption; alarm verification images sent to EMCS are processed only to verify activations, and data in the Ajax Cloud is governed by Ajax’s own privacy policy.

12. Children

Our website and services are not directed at children under 13 and we do not knowingly collect their data. MediCare systems are arranged by adults on behalf of the person they care for. If you believe a child has given us personal data, contact dpo@prismintegratedsecurity.solutions and we will delete it.

13. Changes to this notice

We review this notice regularly and update it when our practices, the law or ICO guidance change. Material changes affecting existing customers will be emailed at least 14 days before they take effect. The date at the top is the date of the current version.